TPM osquery-perf support (#30994)

Fixes #30475

# Checklist for submitter

- [x] Manual QA for all new/changed functionality



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Introduced support for HTTP message signing in agent-server
communications, enhancing request authentication.
* Added a configurable option to control the probability of agents using
HTTP message signatures via a new command-line flag.
* **Bug Fixes**
* Improved error logging for issues encountered during HTTP signature
key retrieval, providing better visibility into failures.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

ee/server/service/hostidentity/httpsig/httpsig.go

@@ -11,6 +11,7 @@ import (
 	"github.com/fleetdm/fleet/v4/ee/server/service/hostidentity/types"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/go-kit/log"
+	"github.com/go-kit/log/level"
 	"github.com/remitly-oss/httpsig-go"
 )
 
@@ -55,15 +56,24 @@ func (h *HTTPSig) Verifier() (*httpsig.Verifier, error) {
 func (h *HTTPSig) FetchByKeyID(ctx context.Context, _ http.Header, keyID string) (httpsig.KeySpecer, error) {
 	keyIDInt, err := strconv.ParseUint(keyID, 16, 64)
 	if err != nil {
-		return nil, fmt.Errorf("invalid hex key ID: %w", err)
+		err = fmt.Errorf("invalid hex key ID: %w", err)
+		h.logger.Log("level", "info", "msg", "FetchByKeyID error", "err", err)
+		return nil, err
 	}
 	identityCert, err := h.ds.GetHostIdentityCertBySerialNumber(ctx, keyIDInt)
-	if err != nil {
-		return nil, fmt.Errorf("loading certificate: %w", err)
+	switch {
+	case fleet.IsNotFound(err):
+		return nil, fmt.Errorf("certificate not found with keyID: %d", keyIDInt)
+	case err != nil:
+		err = fmt.Errorf("loading certificate: %w", err)
+		level.Error(h.logger).Log("msg", "FetchByKeyID error", "err", err)
+		return nil, err
 	}
 	publicKey, err := identityCert.UnmarshalPublicKey()
 	if err != nil {
-		return nil, fmt.Errorf("unmarshaling public key: %w", err)
+		err = fmt.Errorf("unmarshaling public key: %w", err)
+		level.Error(h.logger).Log("msg", "FetchByKeyID error", "err", err)
+		return nil, err
 	}
 
 	var algo httpsig.Algorithm
@@ -73,7 +83,9 @@ func (h *HTTPSig) FetchByKeyID(ctx context.Context, _ http.Header, keyID string)
 	case elliptic.P384():
 		algo = httpsig.Algo_ECDSA_P384_SHA384
 	default:
-		return nil, fmt.Errorf("unsupported elliptic curve: %s", publicKey.Curve.Params().Name)
+		err = fmt.Errorf("unsupported elliptic curve: %s", publicKey.Curve.Params().Name)
+		h.logger.Log("level", "info", "msg", "FetchByKeyID error", "err", err)
+		return nil, err
 	}
 
 	return &KeySpecer{